Embodiments of the present invention relate in general to payment transactions, and can apply to contactless smart card transactions involving credit or debit cards associated with an account identifier.
Generally, contactless smart cards are designed to provide a consumer with an efficient method of payment. The smart cards are able to transmit required information to the merchant's point of service (POS) device to complete the transaction by using, for instance, radio frequency (RF) or infrared (IR) signals. The merchant's POS device receives the transmitted information and processes the transaction.
Because contactless smart cards transmit information, security measures are needed to protect the consumer from sophisticated fraudsters who may intercept this information. To provide protection in transactions, a dynamic card verification value (dCVV) can be derived using an account identifier such as an account number. However, this is problematic because the entire account identifier is transmitted unencrypted as it is sent to an issuer associated with the card.
As a result, account information may still be intercepted. Intercepted account information can potentially be used to conduct fraudulent transactions.
One method of countering the theft of sensitive information is to encrypt any transmitted transaction or consumer data. Encryption generally involves encrypting transaction data at one end of a transmission with a key, and then regenerating the original transaction data by decrypting the received encrypted data with the same key at the other end of the transmission. While encryption is effective in preventing information theft, an existing merchant infrastructure requires upgrading to be capable of processing a received encrypted signal from a smart card. Due to the cost, time, and risk of potential business interruption, many merchants, for example, resist making necessary upgrades to their procedures and systems.
Therefore, what is needed is a system and method for obscuring the account information in a manner that prevents an unauthorized user from using the account information. There is a further need for a system and method for obscuring the account identifier that does not require any changes to the installed terminal base or network infrastructure.
It would further be desirable to provide for the ability to authenticate a consumer's card without providing a separate dCVV value in an authentication request message. Authentication request messages contain a small amount of data, since they need to be quickly transmitted to the issuer for approval. If the dCVV value is not included in a dCVV data field in an authorization request message, other useful data could be included therein or less data would need to be transmitted to the issuer.
Embodiments of the invention address the above problems, and other problems, individually and collectively.